Strange problem on Ping from cacti (not from spine or CLI)

[Rno]

I have a strange issue that I can't find the origin.

All my device are tested with ping ICMP and SNMP uptime.
Spine is working fine, and for him the ping is working as it should be.

but on the GUY all my device show a ping time out, even if the device is displayed as UP (SNMP is working correctly also)

I try to do a ping from CLI as the user of the web server, and it's working fine.

So where to look for it ?

That's my cli ping:
-rwxr-xr-x. 1 root root 67712 Oct 14 19:19 /usr/bin/ping

Thanks for any idea

[macan]

cacti version?
selinux enabled?

[Rno]

Cacti 1.2.26 dev repo of last week
SElinux is active but is configured as permissive, so in my understanding it's not applied.

[macan]

something about ping is reported
https://github.com/Cacti/cacti/issues/5665

[bike]

New installation of Cacti 1.2.26 - Rocky Linux 8.9, php 8.3.
I came across this problem, I was having a problem with SeLinux.
After debugging and googling, a solution appeared -

module httpd_ping 1.0;

require {
type httpd_t;
class capability { net_admin net_raw };
class icmp_socket { create getopt read setopt write };
class rawip_socket { create getopt read setopt write };
}

#============= httpd_t ==============
allow httpd_t self:capability { net_admin net_raw };
allow httpd_t self:icmp_socket { create getopt read setopt write };
allow httpd_t self:rawip_socket { create getopt read setopt write };

Please criticize.

[macan]

With enabled selinux, you can meet more issues (I guess sending emails, ...). We don't have any howto set selinux correctly for Cacti system.

[Rno]

Yes your right Macan
I try it first to comply with SElinux in enforce mode, but it's a real pain in the neck.

That's why I decide to set it up in permissive mode, and that should create any problem.

And I don't find any issue in SELinux that explain why the ICMP ping is displayed as down on the GUY, but still the device is up.

[macan]

SELINUX disallow to create ICMP socket. So ICMP ping is not possible

[bike]

Perhaps the starter topic has a different problem, but I gave the solution to the problem with ICMP ping with SeLinux enabled above.

[Osiris]

If using selinux, you have to first enable permissive mode and the run audit2allow to permit thing before going into restrictive settings. With so many Linus varient installing into different locations, the Cacti Group has elected to have admins train themselves using this process.